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Abstract — Collective detection is an efficient eavesdropping de- 
tection strategy in which the detection is taken only once after the 
whole process of particle transmission. Such detection strategy 
not only improves the efficiencies of the protocols but also reduces 
the cost of realization as the users (except for center) only need 
to perform unitary operations in the whole communication. The 
unitary operations, which cannot be discriminated precisely, are 
of vital role in the multiparty quantum cryptographic protocols 
with collective detection (MQCPs-CD). However, constructing 
such operations is still a difficult point that exists in designing 
this kind of protocols. In this paper, we present a method 
for constructing the required operations for MQCPs-CD with 
different kinds of quantum states. It is a general method which 
is helpful for designing secure MQCPs-CD over different kinds 
of quantum channels. Utilizing this method, we first present two 
robust three-party quantum key distribution (QKD) protocols 
with collective detection over collective-dephasing noise channel 
and collective-rotation noise channel respectively. Then we also 
propose a robust three-party QKD protocol with collective 
detection which can resist all kinds of unitary collective noise. 
Compared with the precious MQCPs-CD, our protocols are the 
first ones which can not only resist channel noise, but also utilize 
collective detection strategy. At last, we prove the security of 
all the proposed protocols based on the theorems of quantum 
operation discrimination. 

Index Terms — Quantum cryptography, quantum key distri- 
bution, collective detection, quantum operation discrimination, 
collective noise. 



I. Introduction 

Over the last two decades, the principles of quantum me- 
chanics have been applied in the field of information, which 
has promoted many interesting and important developments 
in quantum cryptography and quantum computation. Since 
the pioneering work of Bennett and Brassard [1], quantum 
cryptography has attracted a great deal of attention. So far, 
it has been one of the most promising applications of quan- 
tum information processing. There are several remarkable 
branches of quantum cryptography, such as quantum key 
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distribution (QKD) [1]-[10], quantum secret sharing (QSS) 
[1 1]-[15], quantum secure direct communication (QSDC) [16]- 
[22], quantum identity authentication (QIA) [23]-[25] and so 
on. As one of the most important part of quantum crypto- 
graphic protocols, multiparty quantum cryptographic protocols 
(MQCPs), including at least three participants, such as three- 
party QKD protocols and n-party QSS protocols, are more 
complicated than the two-party ones. Therefore, more attention 
is needed in the research of MQCPs. 

In most of MQCPs, detection should be taken in every step 
of the particles' transmission. While this detection strategy, 
which is called the step-by-step detection, always makes the 
protocols complicated and inefficient. On the other hand, 
the action of detection also requires the participants in such 
protocols to be equipped with quantum devices, e.g., the qubit 
measuring machine or the quantum memory. However, based 
on the current technology, these quantum devices are still 
expensive because of the difficulties on their constructions. So 
it is unrealistic that every participant is equipped with these 
quantum devices. Therefore, the protocols would be more 
efficient and easier to realize if the detection is taken after the 
whole process of the particle transmission, i.e. the collective 
detection. Collective detection is an efficient detection strategy 
in which detection need taking only once after the whole 
process of particle transmission. Such detection strategy not 
only improves the efficiencies of the protocols but also reduces 
the expense of realization. To date, much attention have 
been focused on this efficient detection strategy and a lot of 
protocols haven been proposed [27]-[33]. 

QKD enables two parties to produce a random secret key 
known only to them, which can be used to encrypt and de- 
crypt messages afterwards. In order to improve efficiency and 
practicality, some three-party (a center and two users) QKD 
protocols [26] -[29] were presented with collective detection 
strategy. In 1995, Phoenix et al. proposed a three-party QKD 
protocol in which the two users only equip with the unitary 
operators for the key distribution ||26| . However, the qubit 
efficiency of this protocol is only 13%. In 2009, Shih et al. 
put forward two three-party QKD protocols with collective 
detection in noiseless channel with single photons 11271 . which 
have much higher qubit efficiency than the one in Ref. [26]. 
One of the QKD protocols in Ref. 112711 must be executed with 
an honest center and in the other QKD protocol, the center 
does not have to be trusted. However, there is a flaw in their 
protocols. In 201 1, Gao et al. pointed out that the two protocols 
are both susceptible to the dense-coding attack [28], by which 
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an outside attacker can eavesdrop all the session key without 
arousing any suspicion. After that, Liu et al. improved the 
two three-party QKD protocols to be able to resist Gao et 
al.'s attack and pointed out that the unitary operations used to 
encode the information should not be discriminated precisely 
in this kind of protocols] 29 1. Hence it is of great importance 
to find appropriate unitary operations in the MQCPs-CD. 

However in practice, the qubits transmitted in quantum 
channel often interact with the environment uncontrollably, 
which will introduce noises into the communication and influ- 
ences both the correctness and efficiency of communication. 
The noise, such as vibration, thermal fluctuation, and the 
imperfection of the fiber, will not only decrease the fidelity of 
the transmitted qubits, but also give the eavesdropper a chance 
to disguise her disturbance to the communication. To reduce or 
avoid the decoherence of quantum qubits caused by the chan- 
nel noise, some good strategies, such as entanglement purifica- 
tion [35 1, single-photon error rejection ll36l and decoherence- 
free subspace (DFS) [36] -[44], have been proposed. For the 
protocols utilizing the strategy of single-photon error rejection 
or the ideal of DFS, there is an important precondition named 
the collective noise assumption 11341 . [40|. That is, the qubits 
travel inside a time window that is shorter than the fluctuation 
of the channel noise. Supposing that several photons transmit 
through the noisy channel simultaneously or they are spatially 
close to each other, the transformations caused by the noise 
on each of the qubits is identical. 

Till now, in order to resist collective noise, many proto- 
cols have been presented with the ideal of DFS [36] -[44]. 
Nevertheless, although collective detection strategy has the 
advantages of higher efficiency and lower cost of realization, 
these is still no protocol which can not only stand against 
channel noise but also utilize such detection strategy. It is just 
because of the enormous difficulty in constructing the required 
indistinguishable operations over collective-noise channel that 
there is still no such kind of protocol. 

In this paper, a method for constructing the required oper- 
ations, which cannot be discriminated precisely, is presented. 
This is a general method which can be used to design 
MQCPs-CD with different kinds of quantum states, such as 
single-photons, EPR pairs, GHZ states, etc. Based on this 
method, we first present two robust three-party quantum key 
distribution (QKD) protocols with collective detection over 
different collective-noise channels using two-particle states. 
One is against collective-dephasing noise, the other is against 
collective-rotation noise. Then we propose a three-party QKD 
protocol with collective detection which can resist all kinds of 
unitary collective noise using four-particle states. In these three 
protocols, the center should be honest and the two users only 
need to perform unitary operations on the states. After that, we 
also propose another three corresponding schemes in which the 
center need not to be trusted and the two users should have the 
abilities of performing unitary operations and storing qubits. 
Compared with the precious MQCPs, our protocols are the 
first ones which can not only stand against channel noise but 
also utilize such detection strategy. 

The rest of this paper is organized as follows. The next 
section first presents a interesting method for constructing 



the required unitary operations which cannot be discriminated 
precisely over different kinds of channels. In section 3, our 
robust three-party QKD protocols (both the ones with an 
honest center and the ones with a dishonest center) with 
collective detection over different collective-noise channels 
are proposed in detail. In section 4, the security of the 
our proposed protocols is proved by using the theorems of 
quantum operation discrimination. Finally, a short conclusion 
is given in Section 5. 

II. The Method for Constructing The Unitary 
Operations Required in Collective Detection 
Strategy 

Till now, many MQCPs [27] -[28], [48] -[50] have been 
attacked since the unitary operation used in these protocols 
can be discriminated precisely if an eavesdropper utilizes some 
special attack strategies, such as dense-coding attack, fake- 
signal attack, etc. It is just because there is still no efficient 
method for constructing the required operations that some 
protocols may utilize improper ones to design MQCPs. In this 
section, we will present a general method for constructing the 
required operations which cannot be discriminated precisely 
in detail. Then we will prove the correctness of this method 
by using the conclusions on quantum operation discrimination. 
This is a useful method since it can be generally used to design 
MQCPs-CD over different kinds of quantum channels. 

A. Description of our method 

Let us first introduce the basic principle of the MQCPs- 
CD [27]-[33]. In this kind of schemes, two conjugate 
measuring bases (MBs) are first required, which are de- 
noted as {|o),|6)> and {|c),|rf>}. Here, |(a|6)| 2 =|(c|d)| 2 = 0, 
\(a\c)=(a\d)\ 2 =\(b\c)\ 2 =\(b\d)\ 2 =l/2. Besides, there should 
also be a center who is responsible for generating and mea- 
suring qubits. The center generates a sequence of states in 
the two bases and sends them to the first user. Then the 
first user performs his unitary operations on the states, after 
which he sends the sequence to the second user. The second 
user does that which is the same as what the first user does. 
Afterwards he sends the sequence to the next user. When the 
last user finish his operations, he sends the sequence back to 
the center. After the receiving the sequence, the center do the 
eavesdropping check with the help of the classical information 
announced by the users. 

For each of the users in such protocols, after the receiving 
of the sequence, he first encodes his secret by performing the 
operation / (identity operator) or U (encoding operations) on 
the states in the two bases. The effect of the unitary operations 
U is that it flips the state in the same MB, i.e. U\a) = a\b), 
U\b) = fla), U\c) = 7 |d), U\d) = 8\c). Here a,j3,~/,5 
are global phase factors which can be ignored. After that, 
he disturbs the encoded states by randomly performing the 
operation / (identity operation) or C (control operations) on 
the encoded states. The effect of the unitary operations C 
is that it flips a state from one base to the other base. If 
an eavesdropper wants to get some information of the user' 
secret without leaving a trace in the eavesdropping check, 
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Fig. 1. Take two-qubit unitary operations for example. This figure shows the 
definition of the function r(U) = r, where Ai, A2, A3 and A4 are eigenvalues 
of the matrix U and r is the distance between the origin of the complex plane 
o and the polygon A1A2A3A4 (r = when o is in/on the polygon). 



she should have the ability of discriminating the four unitary 
operations /, U, C and UC precisely. Therefore, the key point 
of designing a secure MQCP-CD is to find the appropriate 
unitary operations U and C. 

Now we present the method for constructing the required 
unitary operations. Suppose V is a d-dimensional Hilbert 
space. Using the Gram-Schmidt procedure, it is easy to con- 
struct an orthonormal basis {|0), \d — 1)} for V. It can be 
easily proved that {|0), |1)} and {|+), |— )} are two conjugate 
measuring bases. Here, 

l+) = ^(|0)-»|l», |-> = -^(|l)-i|0» (1) 



Then the required encoding operation could be in the form of 



[/=|0)(1| + |1)(0|+M 



Here, the part M should meet the following two conditions: 
First, M should be a proper form in order to make U be 
an unitary operation, i.e. U'U=UU'=I; Second, M should 
be orthogonal to both |0) and It can be easily proved 
that the operation U in Eq. (2) could flips each one of the 
states {|0), |1), |+), |-)} in the same MB when M is in a 
required form. There are many reasonable choices for the 
form of M, such as M = \2){2\+, ... + \d-l){d- 1| and 
M = |2)(3| + |3)(4|+,...,+|d- 1)(2|. After we get a proper 
encoding operation U, we choose one of the square roots of 
unitary operation U as the control operation, which could flip 
each one of the states {|0), |1), |+), |— )} from one base to the 
other base, i.e. C =VU. The choice approach for operation 
C will be given in the following proof. Till now, an efficient 
method for constructing the required encoding operation and 
control operation has been presented. 

B. Proof of the proposed method 

Now we will demonstrate that the four unitary operations 
/, U, C and UC cannot be discriminated precisely if they 
are constructed by our method. Before demonstrating, we 
first introducing an important theorem on quantum operation 
discrimination. 

Theorem 1 |29l, |52[ Under the condition that the device 
can be accessed only once, the minimum error probability to 



discriminate the two operations U\ and U 2 is 
1 



Pr = 



1 



1 - A PlP2 r(UlU 2 ) 



(3) 



Here, r(fZ/{72) denotes the distance between the origin 
of the complex plane and the polygon (line segment if the 
operations are single qubit operations) whose vertices are the 
eigenvalues of the unitary operator U\U 2 (see Fig. 1), and 
represents the adjoint matrix of U. 

Corollary 2 Under the condition that the device can be 
accessed only once, two unitary operations U\ and U 2 can be 
discriminate precisely if and only if Tl(U\U 2 ) = 0. 

As described in the presented method, C=\/U (U=C 2 ). 
It can be easily found that i(P C)=i{WUC)=v(C), 
r([/tc) =r ({7-ic) =r (c-i) =r (crt), According to Theorem 
1 and Corollary 2, under the condition that the device can 
be accessed only once, the two operations / and C (U 
and C, U and UC) constructed by our method cannot be 
discriminated precisely if and only if both r(C^) and r(C) 
are not equal to zero. Now we demonstrate that both r(C^) 
and r(C) are not equal to zero, i.e., r(C^)>0 and r(C)>0. 
Since U is an unitary operation, all the eigenvalues of U are 
the points on the unit circle in complex plane. That is, all the 
eigenvalues of U can be written in the form of eH e + 2fe7r ), here 
e r(9+2kir) =e re^ 2tt), keZ. Therefore, all the eigenvalues 
of the operation \/U should be in the form of e l ^" +k7r \ 



here 



„i(/3+fc7r)_ i(|+fc ff ) 



/3e[0, 7r), k£Z. It is obviously 



that U has more than one square roots. Take the Pauli 
operation ctq as an simple example. Since ao can be written 
as either e i0 10> <0| + e 4 -°|l)(l| or e*°|0)(0| + e J - 27r |l)(l|, 



(2) both e v0 |0}(0| + e 4 -°|l)(l| and e l 



e V7r |l)(l| are the 



square roots of a^, i.e., ao=a^, aa=a 2 . 

In our method, we choose the special square root (of U) 
whose eigenvalues are all in the form of e 1 ^ (corresponding 
to the cases that k is even) as the control operation C. As 
/3e[0,7r), all the the eigenvalues of C is the points on the 
upper half of the unit circle (except for -1) in complex plane 
and therefore r(C)>0. In addition, since all the the eigenvalues 
of C is the points on the upper half of the unit circle (except 
for -1), it is evident that all the the eigenvalues of are 
the points on the bottom half of the unit circle (except for 
-1), which means r(C^)>0. That is to say, the two operations 
/ and C (U and C, U and UC) constructed by our method 
cannot be discriminated precisely. 

Till now, we have proved that the four unitary operations 
/, U, C and U C cannot be discriminated precisely if they are 
constructed by our method. Utilizing this method, we can find 
the required bases and unitary operations for designing secure 
MQCPs-CD over different channels. 

C. The role of the proposed method 

If someone wants to design a MQCP-CD using a certain 
kind of quantum state in his favour, one of the most important 
thing he should do is to find the corresponding encoding 
operation (U) and controlling operation (C) which cannot be 
discriminated precisely. Obviously, the method we just pro- 
posed above can be used to construct such unitary operations 
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according to the kind of the quantum state the designer wants 
to use. For example, if he wants to design a MQCP-CD 
with single photons, a natural choice for one the two bases 
could be {|0 S ) and |l s )}, here |0 S ) and |l s ) represent the 
horizontal and vertical polarizations of photons respectively. 
Utilizing our method presented above, the other base could 
be chosen as{|+ s ), |- s )}, here |+ s ) = -^(\0 S ) - i\l s )), 
\ — ) = — *|0 S ) ), and the corresponding encoding oper- 

ation (U s ) and controlling operation (C s ) can be constructed 
as follows. 



|o s )( s i| + |i s )( s o| 



C' 



l + i 



1 

1 



1 -i 

-i 1 



(4) 



(5) 



It can be easily verified that {|0 S ), |l s )} and {|+«),| — s )} 
form two nonorthogonal unbiased bases. Also the effects of 
the two unitary operations on the four states can be described 
as follows. 



Us\0) = |1>, 
U s \+) = \-), 

c.\o) = {^)\+h, 

Cs\+) = (^)\1)l, 



|0)l; 



C s \1)l = 



U.\1) L 

U s \-)l 
)l 



V2' 

c s \-) L = C-^)\o) L . 



(6) 
(7) 



Utilizing the two bases and two operations (U s and C s ) 
given above, one can design different kinds of secure MQCPs- 
CD with single photons. Obviously, there still are some other 
choices of the two operations if we choose other single 
particles to act as the two bases. To date, in order to improve 
the efficiencies and reduce the expense of realization, many 
MQCPs-CD [27]-[33] have been proposed with single pho- 
tons. Unfortunately, all of the previous protocols which utilize 
collective detection were designed [27]-[33] in ideal condition, 
hence they can not resist the noise in the quantum channel. 
However, how to design protocols in non-ideal condition is 
one of the key research points in quantum cryptography at 
present. Hence in next section, we will focus on the three- 
party QKD protocols with collective detection over different 
collective-noise channels based on the presented method. 

III. Proposed Quantum Key Distribution 
Protocols Over Collective-Noise Channels 

Utilizing the presented method in the previous section, two 
robust three-party quantum key distribution (QKD) protocols 
with collective detection over different collective-noise chan- 
nels are first proposed using two-particle states. One is against 
collective-dephasing noise, the other is against collective- 
rotation noise. Then we also present a three-party QKD 
protocol with collective detection which can resist all kinds 
of unitary collective noise using four-particle states. In these 
three protocols, the center, which is consider to be honest, 
is responsible for generating and measuring states. The user 
(Alice) can encode her session key into the states produced 
by the center, and the other user (Bob) can deduce the session 
key from the measuring results published by the center. In 



this case, the users (Alice and Bob) only need to hide their 
secrets in the transmitted states with proper unitary operations. 
What's more, considering the center may be malicious and try 
to eavesdrop the session key shared between the users in some 
situations, we also propose the corresponding schemes with a 
dishonest center. These protocols are the first ones which can 
not only stand against channel noise but also utilize collective 
detection strategy. 

A. Robust Quantum Key Distribution Against Collective- 
Dephasing Noise 

A collective-dephasing noise can be described as 



tf|0> = |0>, tf|l) = e*|l> 



(8) 



where <f> is the noise parameter and it fluctuates with time. 
|0) and |1) represent the horizontal and vertical polarizations 
of photons, respectively. In general, a logical qubit encoded 
into two physical qubits with antiparallel parity is immune 
to this kind of noise as these two logical qubits acquire the 
same phase factor through the collective-dephasing noise 
channel. 



10^ = 10)11), |i)l^|i)|0) 



(9) 



To communicate securely, at least two nonorthogonal measur- 
ing bases (MBs) are required. One of the bases is in Eq. (7), 
the other is 

= -±=(|0) L - i\l) L ); \-) L = -±=(\1) L - i\0) L ) (10) 

It is straightforward to verify that |(+|0)l| 2 = |(+|1)l| 2 = 
IH0)l| 2 = IH1)l| 2 = 5, which means {|0) L ,|1) L } and 
{|+)io | — )l} form two nonorthogonal unbiased bases. Using 
the method described above, we now construct the encoding 
operation (Ud P ) and control operation (C dp ) for our robust 
three-party QKD protocol against collective-dephasing noise 
as follows. 



Ud P = 



|01)(10| + |10)(01| + |00)(11| + |11)(00| 
/ 1 \ 
1 
10 
\ 1 J 



(11) 



c d 



( 1 









1 J 



(12) 



The effect of the operations U dp and Cd P on the states in the 
two bases can be described as below. 

u dp \o) L = |i)l; u dp \i) L = |o) L 

U dp \+) L = U dp \-) L = \+)l (13) 

C dp \0) L = (^)\+) L ; C dp \+) L = e- 7 i)\l)L 
C dp \l)L = (^)\-) L ; C dp \-)L = (^i)\0) L (14) 
The principle of our robust three-party QKD protocol against 
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Fig. 2. The process of our robust quantum key distribution against collective- 
dephasing noise, where U represents one of the three unitary operations 
{/, CJ , Uii-p}- The classical communications are omitted. 



collective-dephasing noise can be described as follows (See 
Fig. 1). 

(a) The center prepares a sequence of n logical states which 
are all in the state |0) l (denoted as sequence S) and sends 
it to Alice. 

(b) After receiving S, Alice first generates two random binary 
strings of length n, which are denoted as A and A', 
respectively. Then she encodes the states by performing 
U Ai on the i-th state in S. After that, she performs 
operation C Ai on the i-th state in the string (Aj and A[ 
are respectively the i-th bit of sequence A and A' ). 
Here, U°=C°=I (identity operator on two-qubit states), 
U l =Ud p and C 1 =C l d p . Then she sends the new sequence 
(denoted as Si) to Bob. 

(c) After Bob receives the sequence Si, he first generates two 
random binary strings of length n, which are denoted as 
B and B', respectively, then he encodes the states by 
performing Iff on the «-th state in Si. After that, he 
performs operation C Bi the i-th state in the sequence. 
Here, U°=C°=I, U x =U dv and C x =C dp . At last, he sends 
the the new sequence (denoted as S2) back to the center. 

(d) After receiving S2, the center asks Alice and Bob to 
publish the strings A' and B 1 in order to know their 
control operations on each state of the traveling sequence. 
For each state in S2, if the total number of the operation 
C 1 they did is (1 or 2), the center performs / (C^ 1 
or Ud P ) on it. Here, CJ^ represents the inverse of Cd P - 
Then the center makes measurement on each the state in 
basis {|00), |01), 1 10) , |11>} and gets the secret bit d=0 
(Ci=l) if the measurement outcome is |0)l (|1)l). It is 
obviously that Ci=AiQ)Bi. 

(e) After obtaining the string C (C=A(&B), the center ran- 
domly chooses 771 bits out of the n secret bits for 
eavesdropping check. He asks Alice and Bob to announce 
their encoding operations on each of the m states, and 
then he checks whether the outcomes are in accordance. 
If more than an acceptable error rate is found, they abort 
the results, otherwise, Bob can trust the transmission and 
determine a raw key (n — m bits) with the values of the 
rest n — m bits in C announced by the center. At last, 



Alice and Bob can utilize error correction and privacy 
amplification [46|, |47| to establish the final session key. 
In this scheme, with the help of the Center, the users can 
establish a shared secret key over collective-dephasing channel 
only with unitary operations. And almost all the states can be 
employed to establish the secret key except for the ones used 
for eavesdropping check. Besides, the users should set up the 
filter and the beam splitter to prevent the trojan horse attack 

E), Eg. 

B. Robust Quantum Key Distribution Against Collective- 
Rotation Noise 

A collective-rotation noise can be described as 

LTjO) = cos0|O) +sin0|l);t/|l) = - sin0|O) + cos0|l) (15) 

The parameter 9 depends on the noise and fluctuates with 
time. The two Bell states |$+) = ^(|00) + |11>) and 
\^~) = -^(|01) — 1 10)) are invariant under this collective- 
rotation noise. Hence, logical qubits under this noise can be 
chosen as 



r ) L = \^ 



lr>L = I*" 



(16) 



To communicate securely, at least two nonorthogonal measur- 
ing bases (MBs) are required. One of the bases is in Eq. (14), 
the other is 



1 



|+r)i = -^(|0r)i-i|l r )i) 



\/2 



(|lr>L-*|0r)i) 



(17) 



It can be easily proved that |( r +|0 r )i| 



1, 



Kr 



1, 



i, which means {|0 r )z,, |lr)i} 



and |— form two nonorthogonal unbiased bases. 

Using the method described above, we now construct the 
encoding operation (U r ) and control operation (C r ) for our 
robust three-party QKD protocol against collective-rotation 
noise as follows. 



U r 



(0 1 

1 



V 



+ ^-)^+| + |^+)(0-| + |^-)^ H 







c, 







-1 



l+i 



\ 



-1 
/ 

/ 1 

-% 


V 



(18) 



0^ 



1 i 

7 1 / 



(19) 



The effect of the operations U r and C r on the states in the 
two bases can be described as below. 



U T \0 r ) L = \1t)l 
U r \+r) L = \~t)l 
Cr|0 r ) L = (^)|+ P >£ 
C r \l r ) L = (m\- r ) L 



U r \l r ) L = \0 r ) L 
U r \~r)L = \+r) L (20) 
C r \+r)L = (^)|lr>£ 



V2' 

7f )|0r)L(21) 



As in this case of collective-rotation noise, with the help of 
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Fig. 3. The process of our robust quantum key distribution against collective- 
rotation noise, where U represents one of the three unitary operations 
{I, ,U r }. The classical communications are omitted. 



the center, Alice and Bob can also establish a shared secret key 
over all kinds of collective-noise channel with the same steps 
described in the protocol over collective-dephasing channel 
given above. Certainly, there are some differences between 
these two cases. One difference is that the four states used 
for encoding the secret key are {|0 r )i, |+ r )x,, |— r )i} 

this time, not {|0)l, \+)l, m the protocol against 

collective-dephasing noise. Another difference is that unitary 
operations (encoding operation and control operation) are U r 
and C r , not Ud p and Cd P in the protocol against collective- 
dephasing noise. Besides, the users should also set up the filter 
and the beam splitter to prevent the trojan horse attack l55ll . 
1561. 



C. Robust Quantum Key Distribution Against All Kinds of 
Collective Noise 

Utilizing the presented method, we have proposed two 
robust three-party QKD protocols with collective detection 
, which can resist collective-dephasing noise and collective- 
rotation noise respectively. In these protocols, only two- 
particle states and two-particle measurement are required. Now 
in this part, we will propose a fault-tolerant three-party QKD 
protocol with four-particle states, which can resist all kinds of 
unitary collective noise. 

The singlet is one of the decoherence-free (DF) states 
1 34 1, 1 45] which are invariant under any n-lateral unitary 
transformation (i.e., <7® n |0) = \6), where U® n = Z7® ... ® Z7 
denotes the tensor product of n unitary transformations U). 
The amount of quantum information that a given DF subspace 
is able to protect depends on the number N of qubits. For N 
even, the DF subspace spanned by states which are eigenstates 
of the whole Hamiltonian of the qubit-bath system and also 
eigenstates of the interaction Hamiltonian with eigenvalue zero 
has dimension |34|, ATI 

N\ 

d{N) = (N/2) K N/2 + iy. (22) 

For N=2 qubits, there is only one DF state, the singlet state 
For N=4 qubits, the dimension of the DF subspace 
is 2. Therefore, 4 qubits are sufficient to fully protect one 



arbitrary logical qubit against collective noise. A natural 
choice of the orthogonal basis in the 4-qubit DF subspace 
is: 



|0)l = 



JflOlOl) + |1010) - |0110) - |1001))i 2 34 



1 



(2|0011) + 2|1100) - |0101) - |1010) 



-|0110) -|1001»1234 



(23) 



To communicate securely, at least two nonorthogonal measur- 
ing bases (MBs) are required. One of the bases is in Eq. (20), 
the other is 

1 f(|0)l- 1 |1)l) 



V2' 



1 







(24) 



It can be easily verified that |(+|0) L | 2 =|(+|1) L | 2 =|(-|0) L | 2 = 
|(-|l) L | 2 =i, which means {\0) L ,\1) L } and {\+) L ,\-) L } 
form two nonorthogonal unbiased bases. Suppose W is the 
4-qubit Hilbert space whose dimension is 16, then we can 
find an orthonormal basis \0}l, |1)l, |15) for W using the 
Gram-Schmidt procedure. For simplicity, we do not give the 
concrete form of the states \2)l, \3)l, 1 15) as the well 
known Gram-Schmidt procedure is not complicated. After 
getting all the states of the orthonormal basis, we can construct 
the encoding operation (U) and control operation (C) for our 
robust QKD protocol against all kinds of collective noise based 
the presented method. The form of the encoding operations U 
and C are as follows. 



U= |0)(l| + |l)(0|+O; C = 



(25) 



Here, we have many reasonable choices for the from of O, 
such as O = \2)_(2\+, ... + |1~5)(1~5| and O = |2)(3| + 
|3)(4| + ,...,+|f5)(2|. For example, when O = |2)(3| + 
1 3) (4 1 + ,...,+ 1 15) (2 1 , the effect of the operations U and C 
on the states in the two bases can be described as below. 



U\0)l = 

u\+h = \- 

C\0)l = (^)\- 
C\1)l = (^)\- 



l) L ; U\l) L = |0) L 

U\-)l = \+)l (26) 

fU; q+) L = (i^)|i) L 

C\-) L = (^)|0)l (27) 

As in this case with all kinds of collective noise, with 
the help of the center, Alice and Bob can also establish a 
shared secret key over all kinds of collective-noise chan- 
nel with the same steps described in the protocol over 
collective-dephasing (collective-rotation) channel given above. 
Certainly, there are some differences between these two cases. 
One difference is that the four states used for encoding 
the secret key are {|0)i, |l)i, |+)i> p )l} this time, not 

{\0)L, \+)L, \-)l} ({|0 r >£, \l r ) L , \+r)L, |-r>L» m the 

protocol against collective-dephasing noise (collective-rotation 
noise). Another difference is that unitary operations (encoding 
operation and control operation) are U and C this time, not 
Udp and Cd p (U r and C r ) in the protocol against collective- 
dephasing noise (collective-rotation noise). Besides, the users 



7 



should also set up the filter and the beam splitter to prevent 
the trojan horse attack [55], [56|. 

D. Robust Protocols With A Dishonest Center 

Till now, we have proposed three robust three-party QKD 
protocols with collective detection over different collective- 
noise channels based on the presented method in Sec. 2. In 
all these schemes, with the help of an honest center, the users 
(Alice and Bob) can establish a shared secret key only with 
unitary operations. However, in some situations, the center 
may be malicious and try to eavesdrop the session key shared 
between the users. The three-party QKD protocols proposed 
above suffers the eavesdropping attack from the malicious 
center because the center can intercept the sequence Si and 
generate new sequence for Bob in step (b). Then the center 
can deduce the session secret key in step (e) and finish the 
execution of the protocol without being noticed by the users. 
To avoid this situation, we further propose the corresponding 
protocols with a dishonest center. In these three-party protocols 
which can prevent a dishonest center from eavesdropping the 
session key, the center simply generates and measures states 
and only the legitimate users can obtain the session key. Now 
let us describe the steps included in the three-party QKD 
protocol with a dishonest center which can resist collective- 
rotation noise (See Fig. 3). 

S 1 : The center prepares a sequence of n logical states which 
are all in the state \Q t )l (denoted as sequence S) and 
sends it to Alice. 

S2: After receiving S, Alice first generates two random binary 
strings of length n, which are denoted as A and A', 
respectively. Then she encodes the states by performing 
U 1 on the i-th state in S. After that, she performs 
operation C Ai on the z-th state in the string (A; and A\ 
are respectively the i-th bit of strings A and A' ). Here, 
U"=C°=I, V x =U r and C l =C r . Then she sends the new 
sequence (denoted as Si) to Bob. 

S3: After receiving S%, Bob preserves the states and tells 
Alice "OK". 

S4: After receiving Bobs notification, Alice announces the 
string A' to Bob. 

S5: According to the string A', Bob performs I (C" 1 ) on 
the i-th state in S\ if the corresponding bit in A' is 
(1). Moreover, Bob shuffles the sequence of states with 
a permutation function G and sends the processed string 
S2 back to the center through the quantum channel. 

S6: After the receiving of S2, the center makes an measure- 
ment on each the state in basis {|0 r )i, |l r )x,}, gains the 
measuring result C"=shuffled_/1 and sends C back to 
Bob. 

S7: Receiving the sequence from center, Bob first rearranges 
the sequence of C and recovers the string A. Then he 
randomly chooses m bits out of the n secret bits for 
eavesdropping check. He asks Alice to announce her 
encoding operations on each of the m states, and then 
he checks whether the outcomes are in accordance. If 
the error rate is unacceptable, they abort the the results, 
otherwise, Bob can trust the transmission and determine 



Outer 

Prepare DF states \ Measuring DF Mates 




Alice t g Bob 

Generate A,A ti4 i A'll/C"' 

A : I / U : * ~a~a' Shuffle(G) : S, -h> S, 

A':I/C [ 7ok * Recover C and check 
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Quantum channel: 
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Fig. 4. The process of our robust quantum key distribution against collective- 
rotation noise with a dishonest center 

a raw key (n-m bits). Then Bob tells Alice"OK" and they 
can utilize error correction and privacy amplification |46], 
|47| to establish the final session key. 
For the sake of simplicity, we do not describe the 
other two three-party QKD protocols with a dishonest over 
collective-dephasing noise channel and all kinds of uni- 
tary collective noise channel in detail, since the steps in 
these two protocols are same as the the steps in the pro- 
tocol over collective-rotation channel given above, which 
can resist the eavesdropping from an dishonest center. Of 
course, there some difference in these protocols. One dif- 
ference is that the four states used for encoding the se- 
cret key should be replaced with {|0)x, |+}zo | — )l} 
({\0dp)L, |ldp)io \+dp)L, \-4p)l}) in the case of all kinds of 
unitary collective noise (collective-dephasing noise). Another 
difference is that the encoding operation and control operation 
should be replaced with U and C (Ud p and Cd p ) in the case 
of all kinds of unitary collective noise (collective-dephasing 
noise), what's more, in all these cases, the users should be 
equipped with the filter and the beam splitter to prevent the 
trojan horse attack [55], l56l . 

IV. Security Analysis 

In this section, we will prove the security of the proposed 
three-party QKD protocols. We first consider the case that the 
center is honest. After that, we take into account the situation 
that the center is distrusted. 

A. The Case With An Honest Center 

Suppose Eve is an evil attacker who wants to eavesdrop the 
users' secret key without being detected. Eve may intercept 
the legal states sent to the receiver and send the states that 
she prepared instead 11481 . or she can entangle the legal states 
with additional particles [28|. Since the secrets are encoded 
in the operations that the participants performed on the states 
in our protocols, the action to eavesdrop participants' secrets 
is equivalent to discriminate the operations they performed. 
Actually, conclusions on quantum operation discrimination 



s 




Fig. 5. It is an example of r(C/), i.e. i(U}C r ) 



i 

V2' 



have been studied well. Besides Theorem 1 and Corollary 2, 
here we introduce another conclusion on quantum operation 
discrimination. 

Theorem 3 [53 1 The quantum operations 71, • • • , 7„ can be 
unambiguously discriminated by a single use if and only if for 
any i = 1, • • • , n, supp(7^) ^ supp(Si), where supp(7) denotes 
the support of a quantum operation 7 and Si = {jj : j ^ i}. 

In the proposed protocol over collective-rotation channel, 
the unitary operations performed by both the two users 
(Alice and Bob) can be viewed as four unitary operations 
as a whole, i.e. /, U r , C r , U r C r . Here, / is the identity 
operation on two-qibit sates and the operations U r and C r 
are the encoding operation and control operation defined in 
in equations (14) and (15) respectively. Obviously, C r = 
1 • I — i ■ U r + ■ U r C r = I — ill r , which means supp{C r } C 
supp{7, U r , U r C r }. Therefore, these four operations cannot be 
unambiguously discriminated according to Theorem 3. What's 
more, we can also get the same conclusion according to 
Theorem 1. For example, the eigenvalues of the operation 
0C r are {1, 1, i, i}, therefore, r(W r C r ) = 1/V2 (see Fig. 5) 
and the minimum error probability to discriminate U r and C r 
is 



P, 



1 



0.15 



(28) 



Also in this way, we can find that the minimum error 
probability to discriminate / and C r (I and U r C r , U r and 
U r C r ) is P e (w 0.15), which means these operations cannot 
be discriminated precisely. 

In the proposed protocol, the participants' secrets are en- 
coded in the operations they performed on the states. If 
an eavesdropper wants to get participants' secrets without 
introducing any errors in the eavesdropping check, he should 
have the ability to discriminate the four operations, i.e. /, 
U r , C r , U r C r , precisely. However, as we analyzed above, 
the four operations cannot be unambiguously discriminated. 
So the well-known attacks (such as intercept-resend attack, 
measurement-resend attack, entanglement-measure attack and 
dense-coding attack) of an outside eavesdropper will inevitably 
be found in the eavesdropping check. 

What's more, if an eavesdropper performs the trojan horse 
attack [54], he will be able to get the information of the unitary 



operations in bidirectional communication. The adversary can 
insert spy states into the original states as the invisible states 
sent from the sender to the receiver, capture the spy states 
returned from the receiver, and forward the legitimate photons 
to the sender. Because the eavesdropping check cannot detect 
the trojan horse attack, the adversary would obtain the encoded 
information from the spy states. To protect the proposed 
protocols from the trojan horse attack, the filter and beam 
splitter are utilized in our schemes [55], ll56l . which can 
eliminate the spy states so that the eavesdropper can get none 
of the useful information by this attack. 

Till now, we have demonstrated the security of the presented 
QKD protocol over collective-rotation noise channel, in which 
the center should be honest. Of course, as in the cases of 
collective-dephasing noise and all kinds of unitary collective 
noise in which the center is honest, we can also prove the 
security of them just in the same way, since neither the 
operations {/, Ud p , Cd P , Ud P Cd P } nor the operations {/, U , 
C, UC} can be discriminated precisely according to both the 
theorems given above. For the sake of simplicity, here we do 
not describe the proof processes in detail. 



B. The Case With An Dishonest Center 

In some situations, the center may be malicious and try 
to eavesdrop the session key shared between the users. In 
this case, the presented three-party QKD protocols with a 
honest center may suffer the eavesdropping attack from the 
malicious center because the center can intercept the sequence 
Si and generate new sequence for Bob in step (b). Then the 
center can deduce the session secret key in step (e) and finish 
the execution of the protocol without being found by users. 
To avoid the attack from an malicious center, the users can 
execute the proposed QKD protocols with a dishonest center 
which are developed from the corresponding protocols with a 
honest center. The security analysis of the developed protocols 
are as follow. 

First, in these three-party protocols with a dishonest center, 
the attack strategy which an malicious center can use to eaves- 
drop the session key in the schemes with a honest center is 
no longer valid. If an malicious center intercepts the sequence 
Si and generate new sequence for Bob in step S2, he can 
obtain Alice's encoded sequence A after Alice's annunciation 
of sequence A'. However, Without the information about the 
permutation function G, an malicious center cannot recover the 
correct order and return the precise sequence C to Bob, which 
will make his attack found in the eavesdropping check in step 
S7. Second, as demonstrated above, a center (outside attacker) 
also cannot discriminate the fours unitary operations used in 
our protocols with a dishonest center, which means the well- 
known attacks strategies (such as measurement-resend attack, 
entanglement-measure attack and dense-coding attack) can not 
been used to attack our schemes successfully. What's more, 
the filter and beam splitter are also utilized in our schemes 
with a dishonest center l55l . l56l . which can eliminate the 
spy states so that the eavesdropper can get none of the useful 
information by the trojan horse attack [54|. 
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V. Conclusions 

In this paper, we first introduce an efficient strategy called 
collective detection, in which detection is taken only once 
after the whole process of particle transmission. Such detection 
strategy not only improves the efficiencies of the protocols but 
also reduces the cost of realization as the users (except for 
center) only need not to equip with both the qubit generating 
machine and qubit measuring machine. Since the unitary op- 
erations, which cannot be discriminated precisely, are of vital 
role in the MQCPs-CD, a novel method for constructing the 
required operations in different channels is introduced. This is 
a significant method since it can be generally used to design 
(MQCPs-CD) over different kinds of channels. Utilizing this 
method, we presented some robust three-party quantum key 
distribution (QKD) protocols over different collective-noise 
channels, including both the ones with an honest center and 
the ones with a dishonest center. In these three protocols, the 
center should be honest and the two users only need to perform 
unitary operations on the states. After that, we also propose 
three corresponding schemes in which the center need not 
have to be trusted and the two users need to have the abilities 
of performing unitary operations and storing the qubits. Of 
course, this interesting method we presented in this paper 
is very useful as it can also be utilized to find the required 
operations which are needed in many other MQCPs. 

In spite of this novel method, the proposed protocols in 
our paper also have some remarkable advantages. First, the 
presented three-party protocols with collective detection in this 
paper are designed in different collective-noise channels, while 
almost all the multiparty protocols with collective detection are 
designed in ideal condition [27]-[33]. Second, compared with 
the protocols with the step-by-step detection, our protocols 
have the advantages of lower expense for the users and high 
efficiency due to the collective detection strategy. What's more, 
Our protocols have a higher intrinsic efficiency than that in 
the QKD protocols (26l, (381, 04) as all the information 
carriers except for the ones used for eavesdropping check in 
our scheme can be used to create the private key and at most 
1/2 of the states in the latter are useful. 
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